fix(backend): use duration instead of timestamp for auth cookie maxAge (#5821)
The maxAge option in Express's res.cookie() expects a duration in milliseconds, not an absolute timestamp. The previous code was adding `Date.now()` to the validity period, causing cookies to expire decades in the future instead of the intended 1 day / 7 days. This was particularly problematic on macOS due to stricter cookie handling by Safari/WebKit. Addresses #5818 Co-authored-by: njg7194 <njg7194@users.noreply.github.com>
This commit is contained in:
parent
3c0938da9d
commit
2dc3463b69
1 changed files with 2 additions and 2 deletions
|
|
@ -58,13 +58,13 @@ export const authCookieHandler = (
|
|||
httpOnly: true,
|
||||
secure: configService.get('INFRA.ALLOW_SECURE_COOKIES') === 'true',
|
||||
sameSite: 'lax',
|
||||
maxAge: Date.now() + accessTokenValidityInMs,
|
||||
maxAge: accessTokenValidityInMs,
|
||||
});
|
||||
res.cookie(AuthTokenType.REFRESH_TOKEN, authTokens.refresh_token, {
|
||||
httpOnly: true,
|
||||
secure: configService.get('INFRA.ALLOW_SECURE_COOKIES') === 'true',
|
||||
sameSite: 'lax',
|
||||
maxAge: Date.now() + refreshTokenValidityInMs,
|
||||
maxAge: refreshTokenValidityInMs,
|
||||
});
|
||||
|
||||
if (!redirect) {
|
||||
|
|
|
|||
Loading…
Reference in a new issue